Return-oriented programming (ROP) exploits are an increasingly common form of malicious software (malware) that may circumvent certain defenses that mark locations of memory as non-executable. An ROP exploit works by stringing together a large number of existing segments of executable code that each end with a “return” instruction (known as gadgets). Each ROP gadget is typically short, and typically does not correspond to an existing procedure or even an existing instruction boundary in the executable code. The attacker constructs a malicious stack including a series of return addresses pointing to the desired sequence of gadgets. The ROP exploit is performed by causing the processor of the computer to execute software using the malicious stack instead of the legitimate system stack. For example, the malicious stack may be introduced by smashing the stack, using a buffer overflow exploit, pivoting to a new stack, or otherwise corrupting the system stack. Jump-oriented programming (JOP) exploits are similar, but target gadgets that end with an indirect jump instruction rather than a return instruction.
Certain ROP exploits may be prevented by maintaining a “shadow stack” in parallel with the ordinary system stack (also called the “legacy stack”). The shadow stack maintains a copy of the legacy stack in memory inaccessible to ordinary software, and may be used to determine if the legacy stack has been tampered with by malware. The shadow stack may be implemented using binary instrumentation, which introduces a significant performance slowdown for some usages. Technologies for protecting from ROP exploits using a shadow stack are further described in co-pending U.S. patent application Ser. No. 14/498,075, filed on Sep. 26, 2014, and entitled Hardware Shadow Stack Support for Legacy Guests.
Address space layout randomization (ASLR) is a security technique implemented by certain operating systems (e.g., Windows™, Linux™, and OS X®). ASLR may mitigate ROP and JOP exploits. However, separate memory disclosure attacks may be used by malware to bypass ASLR.